Behavioral task
behavioral1
Sample
Challenge_1.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Challenge_1.dll
Resource
win10v2004-20240802-en
General
-
Target
Challenge_1.dll
-
Size
180KB
-
MD5
ed629af9a127724d64185a26d00ae62d
-
SHA1
3204c4352e4765ecf64b9bfa1b5e31c06b9577cc
-
SHA256
b6d7e579a24efc09c2dba13ca90622790866e017a3311c1809c5041e91b7a930
-
SHA512
ac989c584c067425ae2e67111b869239c0548baf085edcd9edb017056cfa3edb208d5fc5431ebb351c190fd4c9adffb673eaf5fc994d7833efcec6ff3511c55f
-
SSDEEP
3072:C5OLkQW8JS0k0wcBalDIs3hlAp5+hQQE89X3Qo+PgaE3:CsWnGYlAp5+hR9sYaE
Malware Config
Extracted
jupyter
MX-2
http://5.254.118.242
Signatures
-
Jupyter Backdoor/Client payload 1 IoCs
resource yara_rule sample family_jupyter -
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Challenge_1.dll
Files
-
Challenge_1.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ